The present invention relates to a method of checking the access of a user operating a first computer system which is access controlled by a first security system to software and/or data on a second computer system which is access controlled by a second security system.
In many instances software applications and data shall be used across platforms. The wider and more heterogeneous availability of applications brings associated problems of authentication and authorisation, i.e. access control. In a distributed computer network the user access to a computer system is regularly controlled by an authentication and authorisation process, wherein the authentication refers to the identity of the user, while the authorisation regards the user's actual rights of access. The authentication is generally effected at the user's point of entry by comparing the user's alleged identity, regularly given with his application for access, with the user's actual identity concluded from the given user individual password. The authorisation of the user results from checking a list of permissions, which is registered in the computer's security system and which is, for example, exclusively accessible for system administrators, for the accuracy of the user's alleged or desired access permissions. This authentication and authorisation process follows different standards, depending on the software system used on the computer. Known solutions include SAF (Security Access Facility) on IBM Mainframes (RACF, ACF2), Kerberos for UNIX and NTLM (NT LAN Manager) under Windows NT. Therefore, a user, who is working on a first computer system, the access to which is controlled by a first security system, may access software and/or data on a second computer system, the access to which is controlled by a second security system, only after being accepted by the second security system, which again performs an authentication and authorisation process. That means the user must apply to the second security system with a password and repeat the verification procedure regarding his identity and his rights of access. This is burdensome and time consuming. However, the direct communication between different security systems is generally not possible due to different formats of data processing and decision making within these security systems. Nevertheless, there is an ever growing need to access remote information or software quickly and easily without giving up the necessary access control. In so called single-sign-on solutions this disadvantage is avoided by passing the user password on from the first computer system to the second computer system.